Californians for Consumer Privacy Introduces California Privacy Rights Act (CPRA) for November 2020 Ballot
On May 4, 2020, Californians for Consumer Privacy (the group behind the ballot initiative that inspired the California Consumer Privacy Act of 2018 (“CCPA”)) announced that it had collected over 900,000 signatures to qualify the California Privacy Rights Act (“CPRA”) for the November 2020 ballot.
The CPRA was introduced in order to amend the CCPA—the law, which has been widely criticized for its overly broad definitions, ambiguous language, and overall lack of clarity. The CPRA, therefore, aims to expand the privacy rights of California residents and to further increase the companies’ compliance obligations.
The CPRA seeks to do the following:
- Sensitive Personal Information – the law will add a new category of information known as “sensitive personal information” and provide new rights for California consumers, allowing them to stop businesses from using their sensitive personal information. This will be defined to include a Social Security Number, driver’s license number, passport number, financial account information, precise geolocation, race, ethnicity, religion, union membership, personal communications, genetic data, biometric or health information, and information about sex life or sexual orientation. The CPRA would also give consumers certain new rights around the use of “sensitive personal information”
- This is the most notable proposed change for consumers, vendors, and hedge funds alike
- Right of Correction – the law will grant Californians the right to ask businesses to make corrections of any personal information that is inaccurate
- Data Breach Liability – The law seeks to revise and clarify the CCPA as it relates to data breach liability. Specifically, it states that any breaches in which a consumer’s email is compromised along with
- their password or
- a security question and answer—which would essentially provide hackers with unfettered access to the consumer’s account—can result in liability for the company
- Children’s privacy – The law seeks to enhance children’s’ privacy rights and to triple CCPA’s fines for collecting and selling private information of minors under 16 years of age
- New Enforcement Arm – The CPRA seeks to establish a new enforcement authority to help protect consumers’ rights, called “the California Privacy Protection Agency”. The CCPA, by contrast, is enforceable by the California Attorney General’s Office
- Increased Transparency – With the help of this new agency and redefined legal requirements, the goal is to increase transparency and to give consumers greater control over their data